Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here: https://t.co/twDxtwCnoQ
🔎 New Research Searchlight Labs uncovered two Discourse vulnerabilities: CVE-2026-55674: cache poisoning → stored XSS. CVE-2026-55420: image processing chain → arbitrary file read/write. Both have been patched. Read the research: https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline https://t.co/3eFuZlwa01
🚨*CVE* CVE-2026-55420 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uplo… https://www.cve.org/CVERecord?id=CVE-2026-55420 ----- Traducción: CVE-2026-55420 Dis… http://infoflow.cloud`
Post summary
A short tweet linking to the CVE record with minimal context, no signs of an exploit, patch, or detailed vulnerability information.
CVE-2026-55420 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uplo… https://www.cve.org/CVERecord?id=CVE-2026-55420
Post summary
The snippet only identifies the CVE and hints at a PDF upload issue, but provides none of the detailed information or evidence needed for a more specific classification.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.6.0 | - | - |